Section Based Category: ANS – Network Design (Question needs more refinement)

[saig1991]

An organization has an online customer portal running on a fleet of Amazon EC2 instances hosted in a single private subnet. The portal connects to a 3rd party API, which is available through a public HTTPS endpoint, to fetch the latest customer data. A NAT Gateway has been integrated to the VPC to allow the private instances to connect to the HTTPS endpoint over the public Internet. Amazon CloudWatch metrics are also configured to properly monitor the application and network performance. The Network team noticed that the new outgoing connections are starting to fail and at the same time, the

ErrorPortAllocation metric in Amazon CloudWatch for the NAT gateway is also increasing at a steady rate.

Which of the following is the MOST suitable solution that the team should implement to further improve data connectivity?

FYI, it’s possible to associate the Secondary IP addresses to the NAT Gateway which will increase the connection pool. As 55,000 connections are per IP and total of 8 IP addresses can be attached.

https://aws.amazon.com/blogs/networking-and-content-delivery/attach-multiple-ips-to-a-nat-gateway-to-scale-your-egress-traffic-pattern/

Perhaps, the question should include about the high availability instead of just improve data connectivity at the end.. Because to ensure the application is in good state and cost effective, attachment of the IP is better than launch of EC2 instances across AZ’s and multiple NAT Gateways.

[saig1991]

The option that says: Associate another Elastic IP address to the NAT gateway is incorrect because it’s not possible to attach a secondary Elastic IP address to a NAT Gateway.

[Irene-TutorialsDojo]

Hi saig1991,

Thank you for bringing this to our attention. You are correct that multiple Elastic IP addresses can be associated with a NAT gateway to increase its connection capacity.

We have corrected the explanation and refined the question to explicitly include a high-availability requirement. Under this requirement, deploying a NAT gateway in each Availability Zone remains the best answer because additional Elastic IP addresses would still leave a single-AZ point of failure.

We have updated the question, and the changes will be reflected soon. Thank you for helping us improve our content!

Best,

Irene @ Tutorials Dojo